Cryptocurrency payments gateway CoinsPaid hit in $37M hack

The platform believes North Korea’s Lazarus Group is behind the attack

CoinsPaid has publicly accused North Korean state-backed Lazarus Group of being responsible for hacking its internal systems on July 22, allowing it to steal $37.3 million. “We suspect Lazarus Group, one of the most powerful hacker organizations, is responsible,” CoinsPaid clarified in a July 26 post. CoinsPaid did not disclose the specifics of the theft, but the incident forced the company to shut down for four days.

Lazarus Group, a cybercrime organization, is attempting to lure in professionals and compromise their GitHub accounts with malware-infected NPM packages in order to infiltrate their computers, according to a July 26 post by cybersecurity platform Socket.Dev.

CoinsPaid has confirmed that its operations are back up in a limited capacity. The company added that customer funds are safe but that the platform and its balance sheet have suffered significant damage.

Even though the exploit was significant, CoinsPaid believes the cybercrime group was after much more money: “We believe Lazarus expected the attack on CoinsPaid to be much more successful. In response to the attack, the company’s dedicated team of experts has worked tirelessly to fortify our systems and minimize the impact, leaving Lazarus with a record-low reward.”

Three days after the hack, CoinsPaid filed a report with Estonian law enforcement to investigate the theft further. In addition, blockchain security outfits such as Chainalysis, Match Systems, and Crystal assisted CoinsPaid during the first few days of its initial investigation.

Blockchain security firm SlowMist thinks the recent CoinsPaid hack may be connected to two other recent hacks, Atomic Wallet and Alphapo, which resulted in losses of $100 million and $60 million, respectively.

CoinsPaid CEO Max Krupyshev is convinced that the Lazarus Group will be held responsible for its actions. “We have no doubt the hackers won’t escape justice.”